FastConnect: With an Oracle Partner

If you haven't already, start the process of ordering the connection from the Oracle partner, setting it up, and then testing it with the partner. It can take some time, depending on the partner.

Summary: Create one or more virtual circuits for a connection in the Oracle Console. If the network design includes more than one virtual circuit, complete the following steps for each one.

Instructions:

Repeat the following steps for each virtual circuit you want to create.

1. In the Console, confirm you're viewing the compartment  that you want to work in. If you're not sure which one, use the compartment that contains the DRG that you'll connect to (for a private virtual circuit). The choice of compartment, along with a corresponding IAM policy, controls who has access to the virtual circuit you're about to create.
2. Open the navigation menu and click Networking. Under Customer connectivity, click FastConnect.

   This FastConnect page lists existing connections and is where you create a new connection. You can also return to this page later to manage the connection.

3. Click Create FastConnect.
4. Select either Single virtual circuit (the default) or Redundant virtual circuits to configure virtual circuits that use different physical devices in the same FastConnect location. See FastConnect Redundancy Best Practices for more about redundancy. If you select Single virtual circuit you can return later to add a redundant virtual circuit.
5. Click Next.

6. Enter the following for the virtual circuit (Virtual circuit 1 if you selected Redundant virtual circuits):

   • Name: A descriptive name for the virtual circuits. The value doesn't need to be unique across your virtual circuits, and you can change it later. Avoid entering confidential information.
   • Create in Compartment: Leave as is (the compartment you're working in).
   • Select Partner and select the partner from the list.
     Note
     
     If you select Megaport as the partner, you can provision the partner side of the circuit using the optional steps mentioned.

7. Select the virtual circuit type (private or public). A private virtual circuit is for private peering (where the on-premises network receives routes for the available private IP addresses). A public virtual circuit is for public peering (where the on-premises network receives routes for the Oracle Cloud Infrastructure public IP addresses). Redundant virtual circuits must both be private, or both public, so this setting is matched on the other virtual circuit. Also see Uses for FastConnect.

   • For a private virtual circuit, enter the following:

     • Select either All traffic or IPSec over FastConnect traffic only. The virtual circuit can be used for IPSec over FastConnect with either choice, but you can select to only allow encrypted traffic on the virtual circuit. Redundant virtual circuits must have the same setting, so this is matched on the other virtual circuit.
     • Dynamic Routing Gateway: Select the DRG to route the FastConnect traffic to. IPSec over FastConnect requires an upgraded DRG. This DRG could be attached to multiple VCNs or to other DRGs with attached VCNs.
     • Provisioned Bandwidth: Choose a value. If your bandwidth needs increase later, you can update the virtual circuit to use a different value (see To edit a virtual circuit).
     • Partner Service Key (Optional): Enter the service key provided by your Oracle partner. You can enter this key now or edit the circuit later.

     If your BGP session goes to Oracle (see Basic Network Diagrams), the dialog box includes other fields for the BGP session:

     • Customer BGP IP Address: The BGP peering IP address for your edge (your CPE), with a subnet mask from /28 to /31.
     • Oracle BGP IP Address: The BGP peering IP address you want to use for the Oracle edge (the DRG), with a subnet mask from /28 to /31.
     • Enable IPv6 Address Assignment: IPv6 addressing is supported for all commercial and government regions. See FastConnect and IPv6.
     • Customer BGP ASN: The public or private ASN for your network.
     • Use a BGP MD5 Authentication Key (optional): Select this checkbox and provide a key if your system requires MD5 authentication. Oracle supports up to 128-bit MD5 authentication.
     • Enable Bidirectional Forwarding Detection (optional): Select this checkbox to enable Bidirectional Forwarding Detection.
       Note
       
       When you use Bidirectional Forwarding Detection, your paired device must be configured to use a 300 ms minimum interval and a multiplier of 3.

   • For a public virtual circuit, enter the following:

     • Provisioned Bandwidth: Choose a value. If your bandwidth needs increase later, you can update the virtual circuit to use a different value (see To edit a virtual circuit).
     • Public IP Prefixes: The public IP prefixes that you want Oracle to receive over the connection. All prefix sizes are allowed. You can enter a comma-separated list of prefixes, or one per line.
     • Route Filtering: Choose a Route Filtering option. This selects the routes included in BGP advertisements to your on-premises network.
     • BGP ASN: The public ASN for your network. Present only if your BGP session goes to Oracle (see Basic Network Diagrams). Oracle specifies the BGP IP addresses for a public virtual circuit.
     • Use a BGP MD5 Authentication Key (optional): Select this checkbox and provide a key if your system requires MD5 authentication. Oracle supports up to 128-bit MD5 authentication.
     • Enable Bidirectional Forwarding Detection (optional): Select this checkbox to enable Bidirectional Forwarding Detection.
8. If you're creating a redundant virtual circuit, enter the necessary information for the other virtual circuit (Virtual circuit 2). If you selected Redundant virtual circuits, remember that the virtual circuit type (private or public) and All traffic or IPSec over FastConnect traffic only settings for Virtual circuit 2 are already set to match Virtual circuit 1 and if you change them the settings on the other circuit automatically change to match. If you have service agreements with more than one Oracle Partner, you can select different partners for Virtual circuit 1 and Virtual circuit 2 as long as you select the same Dynamic Routing Gateway. You can also select a different Dynamic Routing Gateway and Provisioned Bandwidth, but this requires configuring peering between the two DRGs and doesn't improve the redundancy posture.
   Note
   
   Creating a redundant virtual circuit is optional if you selected Redundant virtual circuits and the partner you selected creates a Layer 3 connection to OCI, but a redundant virtual circuit is required if the partner you selected creates a Layer 2 connection. See FastConnect Redundancy Best Practices for more about Layer 2 and Layer 3 connections.

9. Click Create.

   The virtual circuit is created and a status page displays. Click Close to return to the list of virtual circuits.

10. Click the name of the virtual circuit you just created. While the virtual circuit is in the PENDING PARTNER state, its OCID and a link to the partner's portal are displayed in the "Connection created" confirmation box at the top of the page. The virtual circuit's OCID is also available with the other virtual circuit details. Copy and paste the OCID to another location. You give it to the Oracle partner in the next task. Also copy the OCID for the redundant circuit if you created one.

Until you complete the next task and the partner does their provisioning work, the virtual circuit's Lifecycle State is PENDING PARTNER and the BGP state is DOWN. After the partner does their work, the Lifecycle State switches to PROVISIONED. When the BGP session is established and working, the BGP state changes to UP.

Also see the diagram in To get the status of your virtual circuit.

Contact the partner and give the OCID of each virtual circuit that you created, along with any other information the partner requests. Depending on the partner, you might do this in the partner's online portal, or over the phone. The partner then configures each virtual circuit on their end to complete the connectivity.

If your partner is either Megaport or Colt, you can also connect the OCI Console to the partner and complete the connection yourself from within the OCI Console as described in the following sections.

If your partner is AT&T NetBond: After AT&T gives you the service key for your virtual circuit, you can either edit the virtual circuit yourself or create a ticket at My Oracle Support to request provisioning. Include the service key when creating your ticket.

If your BGP session goes to Oracle: (see Basic Network Diagrams), configure your edge (your CPE) to use the BGP peering information (see General Requirements). Oracle's BGP ASN for the commercial cloud is 31898, except the Serbia Central (Jovanovac) region which is 14544. For the Government Cloud, see Oracle's BGP ASN. By default, Oracle uses the default BGP timers of 10 seconds for keep-alive and 30 seconds for hold-time. If you need fast BGP convergence, you can use any value in these supported ranges: 6-60 seconds for keep-alive, and 18-180 seconds for hold-time. Also configure the router for redundancy according to the network design you decided on earlier (see FastConnect Redundancy Best Practices). After you successfully configure the BGP session, the virtual circuit's BGP session state changes to UP.

If your BGP session instead goes to the Oracle partner: You still need to configure your router if you haven't already. You may need to contact your partner to get the required BGP peering information. This BGP session must be up and running for FastConnect to work. Also configure your edge router for redundancy according to the network design you decided on earlier (see FastConnect Redundancy Best Practices).

Confirm that the light levels are good for each of your physical network connections to the partner. Don't proceed until they are.

Confirm your side of the interfaces for the connections to the partner are up. Don't proceed until they are.

For each virtual circuit, ping the Oracle BGP IP address assigned to the virtual circuit. Check the error counters and look for any dropped packets. Don't proceed until you can successfully ping this IP address without errors.

For each virtual circuit, confirm that the BGP session is in an established state. When it is, the connection is ready to test (see Task 11: Test the connection).

For each virtual circuit, ping the partner's edge. Check the error counters and look for any dropped packets. Don't proceed until you can successfully ping the partner's edge without errors.

Confirm the BGP session you have with the partner is in an established state. Don't proceed until it is.

For each virtual circuit, ping the Oracle BGP IP address (which you can get from the partner). Check the error counters and look for any dropped packets. When you can successfully ping this IP address without errors, the connection is ready to test.

For a private virtual circuit: You should be able to launch an instance in your VCN and access it (for example, with SSH) from a host in your existing private network. See Creating an Instance. If you can, your FastConnect private virtual circuit is ready to use.

For a public virtual circuit:

1. Open the navigation menu and click Networking. Under Customer connectivity, click FastConnect.
2. Click the virtual circuit you're interested in to view its details.

The following diagram shows the different states of the virtual circuit when you're setting it up.

You can change these items for a virtual circuit:

• The name
• The bandwidth
• The service key provided by your Oracle partner (for a private virtual circuit)
• Which DRG it uses (for a private virtual circuit)
• The public IP prefixes (for a public virtual circuit)
• Enable or disable Bidirectional Forwarding Detection
• Configure the virtual circuit to only allow traffic using IPSec over FastConnect. By default any traffic is allowed.
• Depending on the situation, you might also have access to the BGP session information for the virtual circuit and thus can change it.

1. Open the navigation menu and click Networking. Under Customer connectivity, click FastConnect.
2. Select the compartment where the connection resides, and then click the connection to view its details.
3. Click Edit and make your changes. Avoid entering confidential information.
4. Click Save Changes.
5. (Optional) To temporarily deactivate a virtual circuit, click Deactivate. To re-activate the circuit, click Activate. Deactivating the virtual circuit suspends the BGP session and traffic flow without otherwise changing the settings for the virtual circuit.

1. Open the navigation menu and click Networking. Under Customer connectivity, click FastConnect.
2. Select the compartment where the connection resides, and then click the connection to view its details.
3. Click Delete.
4. Confirm when prompted.

The virtual circuit's Lifecycle State changes to TERMINATING and then to TERMINATED.

For general information about the prefixes, see Basic Network Diagrams.

You can specify your public IP prefixes when you create the virtual circuit. See Task 3: Set up virtual circuits.

You can add or remove public IP prefixes later after creating the virtual circuit. See To edit a virtual circuit. If you add a new prefix, Oracle first verifies your company's ownership before advertising it across the connection. If you remove a prefix, Oracle stops advertising the prefix within a few minutes of your editing the virtual circuit.

You can view the state of Oracle's verification of a given public prefix by viewing the virtual circuit's details in the Console. Here are the possible values:

• In progress: Oracle is in the process of verifying your organization's ownership of the prefix.
• Failed: Oracle could not verify your organization's ownership. Oracle will not advertise the prefix over the virtual circuit.
• Completed: Oracle successfully verified your organization's ownership. Oracle is advertising the prefix over the virtual circuit.

You can move a connection from one compartment to another. After you move the connection to the new compartment, inherent policies apply immediately and affect access to the connection through the Console. Moving the connection to a different compartment does not affect the connection between your data center and Oracle Cloud Infrastructure. For more information, see Moving a Compartment to a Different Parent Compartment.

1. Open the navigation menu and click Networking. Under Customer connectivity, click FastConnect.
2. Find the connection in the list, click the Actions menu (), and then click Move Resource.
3. Choose the destination compartment from the list.
4. Click Move Resource.
5. If there are alarms monitoring the connection, update the alarms to reference the new compartment. See Updating an Alarm After Moving a Resource for more information.